​The U.S. Embassy in Afghanistan sent out an uncharacteristically specific security alert on a Thursday afternoon in January: Extremist groups were plotting attacks on hotels in Kabul where foreigners were known to congregate. Stay alert in locations frequented by Westerners, the alert advised, and carry a charged cell phone. 

Two days later, six gunmen carried out a 15-hour attack at Kabul's Hotel Intercontinental, killing at least 22 people before they were overtaken by Afghan forces. About 160 guests were rescued from the attack, which was claimed by the Taliban.

The attack kicked off nine days of deadly ping-ponging between regional rivals ISIS and the Taliban. Two days after the hotel attack, members of ISIS stormed the compound of aid group Save the Children in Jalalabad, killing four ​workers.

Five days later, Taliban militants drove an ambulance packed with explosives near a hospital in Kabul and detonated it, killing more than 100. And just two days after that—on a day that was intended to be a day of mourning for the previous attacks—ISIS carried out an attack on a military base in Kabul that killed 11.

The spate of attacks, which resulted in the deaths of more than 130 people, raised questions about the motivations of both the Taliban and ISIS in the region, the effectiveness of Kabul's fortified perimeter, and the role of private security in preventing such attacks—if they can get a chance.

Although the targets seem disparate—foreigners at a hotel, international aid workers at a compound, locals out and about in the city center, and security forces at a military academy—three of the sites have something in common: they have been attacked by extremist forces before.

While information about the methods and motivations of the attackers and the response by Afghan forces is slow to come to light, comparing the recent attacks with the ones from years past can reveal what has changed in Afghanistan—and what hasn't.

Hotel Intercontinental

Afghanistan's first international luxury hotel sits perched on top of a hill in western Kabul, projecting a fortresslike presence. The hotel was originally developed in the 1960s by InterContinental Hotels Group but has had no association with the chain since 1980, although it retains the name and logo. Scott Stewart, vice president of tactical analysis at Stratfor, notes that the use of the InterContinental brand might confuse tourists who think they will be getting a certain level of security.

In fact, the luxury hotel made the unusual move from using Afghan-provided security forces to private security just three weeks before the January attack. The timing of the exchange has raised questions about what role, if any, the new security team played in the attack.

Private security firms have been banned in Afghanistan since 2010 due to concerns about tribalism and a lack of oversight surrounding the personnel and weaponry brought into the country by private contractors.

Instead, the Afghan Ministry of Interior (MoI) provides police officers to guard checkpoints and businesses, although diplomatic facilities with existing private security can keep their contracts.

Mike O'Rourke, owner and CEO of consulting company Advanced Operational Concepts, says that before the rules were changed, many security contractors went unchecked and were run like warlord militias. "It was a big concern that they were more of a threat than a help," O'Rourke adds.

However, the MoI security personnel have come under scrutiny as well. Last summer, Afghan president Ashraf Ghani called the MoI "the heart of corruption in the security sector" and promised reform.

O'Rourke agrees that corruption is an issue, citing a high-level client conducting business in Afghanistan who wanted his own private security detail. The individual's solution was to bribe the MoI to name his security personnel as police officers.

"He had his trusted members as his personal security, but under the authority of the Afghan government," O'Rourke notes.

Afghan officials are still unsure why and how the transfer of the Intercontinental's security operations from the MoI to a private contractor occurred.

Preliminary reports found that the hotel's security personnel were largely unresponsive to the attack that occurred after militants bypassed two security checkpoints. Additionally, some of the attackers may have been able to access hotel guests via the kitchen, raising concerns about help from insiders.

The January attack appears to have been carried out by the Haqqani network—a Pakistan-based group aligned with the Taliban—and may have targeted foreigners. At least 14 of the 22 people killed were foreigners.

"One of the things that was very interesting in this attack is the limited death toll—these guys were specifically trying to avoid Afghan casualties," Stewart says. "There have been anecdotal accounts of them sparing several peoples' lives when they said they were Afghan."

Indeed, a Taliban spokesperson said that the attack had initially been planned for earlier in the week, but the hotel was hosting a wedding party and the attackers wanted to avoid civilian casualties.

Stewart came to a similar conclusion about the June 2011 attack on Hotel Intercontinental, in which several Taliban militants in suicide vests raided the compound, killing 12 people in an eight-hour period before they were killed.

In an article he wrote for Stratfor in 2011, Stewart pointed out that such attacks by the Taliban may have a relatively low death toll but strive to make sure the threat they pose is not forgotten. The 2011 attack was carried out while officials met in the hotel to discuss the transfer of security from international forces to Afghans—an event that the Taliban disapproved of.

Seven years later, Stewart says the core motives behind the attacks on the hotel haven't changed—they were intended to send a message.

"They really are trying to make a specific point and target a specific target," he says. "That also helps set themselves apart from ISIS in Afghanistan, which has a tendency to conduct more indiscriminate attacks. It's this counterinsurgency idea of winning hearts and minds—the Haqqanis and Taliban are playing the same card, trying to win hearts and minds and not using the same kind of over-the-top brutality that ISIS tends to use."

City Center

The devastating blast occurred during rush hour in what is supposed to be one of the safest parts of the city. In an area with hospitals, schools, and local government and diplomatic buildings, police presence is heavy to provide heightened security.

The ambulance driven by the attackers was able to bypass the first checkpoint after claiming they were carrying a patient, but once they were stopped by officials at the second checkpoint, they detonated the bombs stored in the vehicle.

The Taliban claimed responsibility for the attack, although the U.S. government believes the Haqqani were the masterminds, according to officials.

"I think we need to understand that the Haqqanis just have very good tradecraft and connections—they have repeatedly shown the capability of getting small groups of terrorists into Kabul, and weapons for them," Stewart notes. "Despite the security that's in place, the Haqqanis have a long history of planning and executing these kinds of attacks, and that doesn't seem to be ending at all. They're very resourceful, adaptive attackers."

A Taliban spokesman said the aim of the attack was in response to U.S. President Donald Trump's recently announced plans to step up American involvement in the region. The Taliban also targeted police officers. But experts note that, given the location of the scheme, significant civilian casualties were bound to occur.

In fact, this attack was the deadliest to take place in Kabul since last year's bombing in the same area. That May 2017 attack killed more than 150 people less than a mile away from where the recent attack took place. Attackers detonated a bomb that was smuggled into the fortified area in a tanker truck used to clean out septic systems. No group has claimed the attack, but—once again—Haqqani forces are suspected.

Protests against the government occurred in the days following the 2017 attack, and O'Rourke says the more recent bombing may have had the same underlying intent—to sow discord between the Afghan government and citizens.

"The fact that these attacks are taking place in Kabul, and taking so many lives, shakes public confidence in the ability of President Ghani's government to keep Afghans safe in their nation's capital," O'Rourke says. "To me, making the government look ineffective is the strategic goal of these attacks. A colleague of mine is in Kabul now and the Afghans he talks to primarily blame their government, but they also believe the U.S.-led coalition could be doing more to improve security."

Military Academy

ISIS carried out an early-morning attack against Afghan soldiers guarding a military academy. The attackers were armed with suicide vests, rocket-propelled grenades, and automatic weapons. It took five hours to subdue the five militants at the outer gates of the academy, and 11 Afghan soldiers were killed in the process.

Local officials say that the attack was not targeting the academy itself but the security forces at the perimeters.

The military base sustained another attack just last October, when a lone suicide bomber targeted a bus full of Afghan army cadets leaving the academy. Fifteen cadets were killed, and the Taliban claimed that attack. Like the recent ambush, the attack was carried out along the outer perimeter of the base, targeting a smaller group of soldiers instead of the hundreds within the facility.

The October attack was also a one-two punch by ISIS and the Taliban—less than 24 hours before the Taliban targeted the military academy, ISIS attacked a Shia Muslim mosque, killing more than 50 people.

Looking Ahead

The fact that the same groups are carrying out the same attacks on the same places is not lost on Afghan citizens. Protests similar to those following the diplomatic quarter bombing last year sprang up after the recent nine days of carnage, with calls for a more secure city and a different approach to combating extremism.

And while the attack on the Intercontinental has raised questions about the role of private security in Kabul, O'Rourke says he believes that it shows the need for more regulation is overdue.

"I don't know if it's going to tighten the reins or there will be more of a call for a private security industry where people can get their own vetted people licensed," O'Rourke says. "Not knowing the particulars at the Intercontinental, I don't know where they came from or who vetted them, nor do we know if it was a failure of private security or they were complicit in the attack."

It will take pressure from foreign governments and businesses to influence a change in the rules surrounding the use of private security forces, O'Rourke notes. Until then, locals and travelers alike will have to be extremely careful.

"If foreigners are going to go to Afghanistan and do business there and stay in places like the Intercontinental, and they can't rely on vetted security forces, they have to know they're accepting a great deal of risk," O'Rourke says.

Stewart agrees, suggesting practical travel security tips like staying in a lower floor on a hotel for ease of escape and packing items such as door wedges and smoke hoods in case of an emergency.

"People need to make sure they do good due diligence on those hotels before they book them in those kinds of conflict zones to make sure they have adequate security," Stewart says. "Additionally, they just really need to be prepared to take action. Be prepared to go into active shooter mode—the avoid, deny, defend approach. At the Intercontinental, it sounds like many people were able to flee or deny the attackers access to their location and survive despite the hours these guys were in this hotel."

Meanwhile, both the Taliban and ISIS continue to gain footholds in Afghanistan. One of the captured militants from the military academy attack led officials to an ISIS hideout in Kabul, filled with bombs, equipment, and plans to carry out three more attacks. And extensive research by the BBC reveals that the Taliban is active in 70 percent of the country, contradicting Afghan officials' declarations that it only has a presence in rural areas.

"Additional successful attacks will further erode popular confidence in the current government," O'Rourke says. "This loss of trust might be seen at the polls if Afghanistan manages to hold the parliamentary elections scheduled for this summer." ​